CVE-2022-44543
TYPO3 Extension femanager vulnerable to Broken Access Control
CVE-2022-44543 is a medium vulnerability (CVSS 5.3) in In2code Femanager, published November 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in in2code/femanager 7.0.1.
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
- Record
CVE-2022-44543- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
CVE List No score
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
- Record
CVE-2022-44543- Updated
- 2026-11-02
EUVDEUVD-2022-7238 No score
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
- Record
EUVD-2022-7238- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-59m9-p6cm-94q5
TYPO3 Extension femanager vulnerable to Broken Access Control
The TYPO3 Extension femanager prior to versions 5.5.2, 6.3.3, and 7.0.1 is vulnerable to broken access control. The usergroup.inList validation can be bypassed resulting in new frontend users created by the extension may be members of groups that are restricted. The vulnerability is only exploitable if the field usergroup is available in the registration form. Versions 5.5.2, 6.3.3, and 7.0.1 contain patches.
- Record
GHSA-59m9-p6cm-94q5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-59m9-p6cm-94q5
TYPO3 Extension femanager vulnerable to Broken Access Control
The TYPO3 Extension femanager prior to versions 5.5.2, 6.3.3, and 7.0.1 is vulnerable to broken access control. The usergroup.inList validation can be bypassed resulting in new frontend users created by the extension may be members of groups that are restricted. The vulnerability is only exploitable if the field usergroup is available in the registration form. Versions 5.5.2, 6.3.3, and 7.0.1 contain patches.
- Record
GHSA-59m9-p6cm-94q5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSV No score
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
- Record
CVE-2022-44543- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
in2code/femanagerPackagist |
7.0.0 up to 7.0.1 | 7.0.1 |
in2code/femanagerPackagist |
6.0.0 up to 6.3.3 | 6.3.3 |
in2code/femanagerPackagist |
before 5.5.2 | 5.5.2 |
in2code/femanagerPackagist |
6.0.0 up to 6.3.3, plus listed versions 6.0.16.1.06.1.16.1.26.2.0 Show 4 moreShow less6.2.16.3.06.3.16.3.2 |
6.3.3 |
in2code/femanagerPackagist |
before 5.5.2, plus listed versions 2.5.02.5.12.6.02.6.12.6.2 Show 32 moreShow less2.7.03.0.03.0.13.0.23.1.03.1.13.1.23.1.33.2.03.3.04.0.04.0.14.0.24.1.04.1.14.2.04.2.14.2.24.2.34.2.44.2.55.0.05.1.05.1.15.2.05.3.05.3.15.4.05.4.15.4.25.5.05.5.1 |
5.5.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
typo3.org/help/security-advisories
github.com/in2code-de/femanager/commit/827edbc767b1cb6c0cb77d82e46b88fea3b22ad9